Awesome! I didn't know timechart can do additional columns if we do an eval on it. Thanks a lot!! ... View more

Has anyone else seen this behavior? I'm having the same problem. Single search running every five minutes. I get double the number of entries in the summary_index. ... View more

As far as I know there is no path delimiter normalization in Splunk atm. At least with file monitors and scripted inputs this is the case. So my guess is you will have to create a separate props.conf for Windows. ... View more

Good idea. Thanks for the initial help, though! ^_^ For any of those actually reading through this whole thing, you can check out the new question I created here: http://splunk-base.splunk.com/answers/51696/one-app-but-mutliple-default-pages-depending-on-roles James ... View more

Surprised this isn't answered but the answer is that you simply need the "admin_all_objects" capability. Nothing more. Nothing less. You can try it yourself by adding ALL capabilities. You can create an app. Try it again and remove ONLY admin_all_objects. You can't create an app. Try again and remove everything but add admin_all_objects. You can create an app. In your original question you wanted to give specific users the ability to create apps. This capability is very VERY dangerous in the wrong hands. We had a user that had it (it was a specific capability required in a specific data base app) they proceeded to remove/delete all configurations across the entire system as they didn't realise they weren't inside their own sandbox environment. ... View more

Additional method to filter since Splunk 6.* http://answers.splunk.com/answers/116817/filter-wineventlog-events-based-on-the-eventcodes ... View more

Well that was quick! The latest rpm (splunkforwarder-7.2.6-c0bf0f679ce9) installs via dnf in Fedora 30 without any issues. ... View more

Of course, I could also use the "priority" field instead of naming the stanzas so that they execute alphabetically to make things easier with naming the stanzas. ... View more

Adding my example in the hope that it helps someone else. The server administrator team recently added Splunk to their server build template. This template is used to build new servers. The template hostname was saved to C:\"Program Files"\SplunkUniversalForwarder\etc\system\local\inputs.conf under the [default] stanza. I removed that file on one of the new servers and restarted Splunk. I confirmed this corrected the host name issue. I then asked our server administrator team to remove that file (inputs.conf) from the ..\system\local\ path on the template. Now when a new server is generated using that template it will not put that file on it. ... View more

You may take a look at this app: Web Terminal for Splunk. With it you will be able to work with Splunk CLI on the remote server right through your browser. It will save you from installing the full version of Splunk just for this simple task. ... View more

Thanks, Ruben. The problem was definitely the use of Real Time searches as opposed to just a regular search. I'm now able to get everything to work the way I expected. Also, I found some errors in my saved search with the timeframe I was searching, which also contributed to some issues I was running into. Thanks very much! ... View more

Important: Splunk's built-in system always takes precedence over any external systems. This is the order in which Splunk authenticates a user: 1. Splunk built-in authentication 2. LDAP authentication (if enabled) 3. Scripted authentication (if enabled) https://docs.splunk.com/Documentation/Splunk/4.2.5/Admin/SetupuserauthenticationwithLDAP#Configure_LDAP ... View more

I don't think there is such an option. Classifying hosts by name is one of the most crucial functions of Splunk Deployment Server. I wouldn't expect name resolution to wedge up a Deployment server - unless you're saying you have many clients connecting that don't have valid reverse DNS. What I might suggest is running a local caching DNS server on your deployment server host. Then you'll at least get a quick answer that reverse DNS could not resolve. BIND can do this pretty easily, but for many practical purposes, dnsmasq is just as good. ... View more

have a look at my updated answer for an example of another way to do it ... View more

I am having this exact problem. I wonder if you could share your actual conf things that you added to deal with this. It'd save me a lot of work. ... View more